4

You can create a Site and add a redirect from a Site URL to a destination. The destination can be any relative or absolute URL, including a MyDomain URL. Out of the box, the hostname of the site will be auto-generated and added to a DNS for you by Salesforce. You have an option of using your own, custom domain controlled by your own DNS instead of having ...


3

Marketing Cloud doesn't support OpenID Connect. SSO is only possible using SFMC's SAML 2.0 implementation.


3

The ConnectedAppPlugin is exactly the right place for logic like that. It's the only piece of code that's called during the SSO flow. A Login Flow comes to mind as another option, but unfortunately it cannot detect which connected app started it. The method you can use depends on the settings of your Connected App. If you set it to self-authorize, then you'd ...


2

As per Salesforce documentation: Request Signing Certificate: The certificate used to generate the signature on a SAML request to the identity provider. This signing certificate is used when Salesforce is the service provider for a service provider-initiated SAML login. You save the signing certificate from the Certificate and Key Management Set up page. ...


2

You can only use one value for the Federated ID. The login ID that was provided to the authentication server does not need to be the ID that is presented to Salesforce. Most systems have a concept of a UUID or GUID that identifies the user logging in uniquely, no matter which login method they use. The trick here is that you simply need to configure that ...


2

Salesforce can't enforce password policies for Federated Authentication, because it never sees the password (or even the username!) of the user being authenticated. The authentication is handled entirely by the authentication server, which then provides Salesforce with a unique identifier for that user (the Federation ID) along with a signature that proves ...


2

You can control this scenario by leveraging the Okta auth provider that you've already configured as well as enabling (but not needing to set up) Delegated Authentication. Per the help article on the topic: https://help.salesforce.com/articleView?id=sso_tips.htm&type=5 SSO Login Settings Tips When you configure users with an authentication ...


2

On the Connected App details page grab the value of IdP-Initiated Login URL in SAML Login Information section and use that URL in your button.


1

MC MFA does not work with SSO, the recommendation is to enable some type of MFA with your SSO solution. Review this help doc for additional answers: 'Marketing Cloud Multi-Factor Authentication FAQ' Does MFA Affect API Integrations? No, multi-factor authentication (MFA) only affects authentication for users who log in to Marketing Cloud via their browser or ...


1

redirect_uri is from oAuth and RelayState is from SAML. They're apples and oranges that live in different universes. You will not see them together in the same flow with the exception of extremely rare cases when a SAML flow is triggered by an oAuth flow or vice versa. redirect_uri: after a user successfully authorizes an application, the Authorization ...


1

redirect_url is the authorized endpoint into the system. It should not be a deep link. Services may choose not to authorize the client if the redirect_url is not authorized. The RelayState is the state of the application, which may be a deep link, a collection of data to be used (e.g. a Single Page Application may use a hash fragment), or something else. ...


1

With Delegated Authentication, the user logs in through the normal Salesforce login page, but Salesforce checks with a third-party server for the password. In this case, the user literally has no Salesforce password and cannot log in without the authentication server's permission. Delegated Authentication Flow User -----> Salesforce Login ...


1

This is an error from Google. Please read Salesforce cloud application and follow all of the steps. This includes "installing" and "activating" an app in Google in order to allow access. Unfortunately, we will likely not be able to help you with this error, as the problem is within your Google configuration, not Salesforce.


1

For me it worked: UserData should contains at least an empty Map of attributes(the last paramter in constructor). Otherwise you will recieve Internal Server error.


1

Each community represents its own security context. That is, community B doesn't automagically "trust" community A in terms of user logging in even if the same user is a member of both communities. To go from one to the other without re-authentication, you will need to implement single sign-on via SAML or OpenID Connect. With SAML, your community A will be ...


1

Here are the steps to enable communities as IDP, note it is very similar to the regular salesforce as IDP . Create a my domain for your organization. It is under the Domain Management in set up Under Security control find Identify Provider tab and click "Enable Identity Provider" for the org. Create a connected app with "Enable SAML" checkbox checked. ...


1

The only way I can think to accomplish this, and I have no way of guaranteeing this will work, is to: Configure the URL to point directly to SecureAuth login url Configure SecureAuth to redirect to your community whether or not they are currently logged in (bypass login screen at this stage) Configure the login link to push back to SecureAuth, maybe to a ...


1

So this, according to the documentation, is not an option for SSO sessions, though it is for other session types as found here: https://developer.salesforce.com/docs/atlas.en-us.securityImplGuide.meta/securityImplGuide/admin_sessions.htm


1

The problem was related to IIS not allowing cookies for my test domain. I had to change the node in the web.test.config to use the new domain. Hopefully this helps someone in the future.


1

You simply have to set the NameID and SessionIndex Attribute from the SSO Login Assertion in the Logout Request as well. I can see from your Logout Request that you are not doing this, so you get the status:Responder which is a slight hint that something went wrong. If you miss those values Salesforce will not know which Session to terminate.


Only top voted, non community-wiki answers of a minimum length are eligible